One of the key elements in every data forensics procedure is time. Users may unintentionally or inadvertently overwrite evidence simply by continuing to complete their daily tasks. Intercore will quickly and cost-effectively collect and preserve data or evidence that may have been deleted or become inaccessible through normal computing methods. Intrercore can determine if certain information exists and, if so, where it might be located.

When the data storage media is received at the Intercore facility, an accurate audit trail commences. The media is immediately logged into a tracking system and a logbook is produced. This logbook, suitable for all legal proceedings, accompanies the media through all steps. Any Intercore employee who handles the media ensures the continuity of evidence by adding their name, signature, date and a detailed description of what was done.

At this stage of the process, Intercore's expertise in magnetic media storage(Hard Drives) devices begins to play a crucial role. First the media is replicated exactly on a sector-by-sector basis ensuring the integrity of the subject media and evidence is preserved. Intercore works only with the replicated copy ensuring that no contamination of the original data takes place. In this preliminary examination, Intercore provides the client with a report detailing the file structures, integrity and recoverability of deleted files. This report may be used to determine if the files present will be of assistance in the investigation. Intercore will make recommendations at this point on how to proceed if further information needs to be retrieved. This report allows our clients to make an informed decision on the various options that may be available to them.

The objective of adhering to this rigorous process is to provide our forensic clients with the following results, which may be required in a court of law: